VirtualBox: does the virtual hard-drive REALLY have to be in /home ??

[rybnik]

I'm running Kubuntu 12.04LTS (It's a "hard-metal" installation, as opposed to VM.) and I'm using VirtualBox for the first time. I want to run Fedora 19 XFCE in VirtualBox (already got the .iso).

I have separate partitions for / and /home and I want the virtual hard drive to be in /, not in /home. I used "sudo mkdir" to make the directory /vhd (For some reason, I had to gain root to do that...) to put the virtual hard-drive in. Then in virtualbox, in the gui VM installer, it would only let me create a virtual hard drive in /home, though! Is there a way around this?

Thank you.

[Snowhog]

I don't think so. Why would you want the VM located in /, assuming it could be done?

[richb]

I have put them in other directories and partitions than /home but never in root. Not sure why you would want to.

[rybnik]

so now I see...

Why would you want the VM located in /, assuming it could be done?

Not sure why you would want to.

Well, yes, that's the conclusion that I came to after some more fiddling. To answer my own question, here's what I found:

1. The gui VM maker within VirtualBox could indeed make a virtual HD within / but outside /home, but only when I initialized VirtualBox as root. I had to open it with "sudo VirtualBox %U" instead of "VirtualBox %U" (which I discovered through the kmenu editor--btw, what does the "%U" mean? I noticed that I needed that suffix for it to work.)
2. After making the VM through VirtualBox as root, I found that VirtualBox (root) and VirtualBox (myname) became kind of like different applications, as it were. They had different lists of VMs available.
3. Generally, it's necessary to gain root in order to work with files outside of /home but in /. Seems pretty stupid. That's one good thing about windoze--you don't have to switch back and forth between root and username constantly. Maybe I could just log in as root from the outset? (I've read that that's bad for security, but that's what windoze does by default anyway, right?)

So I ended up just making the VM within /home.

richb--You implied using a directory for a VM outside /home but not in / either. Does that mean an external drive? (edit: Ah, I see that you said other partitions.)

[richb]

Never tried an external drive, but I do not see why not.

No need to switch between root and user. You can run programs in user as root with the run feature and issuing kdesu "programname". In a terminal just use sudo "programname"

Never a good idea to boot and stay in root permanently. It is too easy to corrupt the system.

[kubicle]

Virtualbox should only need write access to the directory you wish to use for your VM. Rather than running virtualbox as root (generally a bad idea to run things as root when it's not necessary), you can change the ownership of the directory (/vhd) to your user or give your user write permissions to the directory.

[claydoh]

A couple of things here. Firstly, there is no need to run a virtual machine (or a vast majority of gui applications) with admin privileges. This keeps things from getting busted if something with read/write privileges writes to/erases something important. This is a key difference from a Windows environment, these file permissions and users.

If you really want to put a folder in root, you can change the permissions on that folder so that it is readable and writable by all your user accounts.
it is also way way easier to back up and manage settings and data - your VM's, for example - by having everything in /home, as you already have.

[SteveRiley]

3. Generally, it's necessary to gain root in order to work with files outside of /home but in /. Seems pretty stupid. That's one good thing about windoze--you don't have to switch back and forth between root and username constantly. Maybe I could just log in as root from the outset? (I've read that that's bad for security, but that's what windoze does by default anyway, right?)

First: this behavior is by design. Second: Linux is not Windows.

For many years, application developers assumed that all Windows users logged in as local administrators. A nasty side effect of this is that opening a web browser means that the Internet becomes a local administrator of your computer, and bad guys take advantage of this to wreak havoc on PCs. Windows Vista changed this by introducing User Account Control. UAC is not a security boundary, but instead a mechanism to irritate users into demanding that developers write their software to need fewer elevated rights. (I worked for Microsoft during this time and can fully support the previous statement if you'd like.) Now, many programs will work fine on standard user accounts and this is the preferred way to run Windows 7 and 8. But, alas, it is still not the default for the first user created during setup.

Linux takes a different approach. User accounts are always standard, with no system-wide privileges. Standard accounts have read-write access to their own home directories and read-only access to the operating system files. This protects the system from inadvertent or malicious modification. This style is far from stupid; in fact, the closer Windows comes to eliminating the need to do day-to-day activities as administrator, the more difficult it is becoming to attack. A hard boundary between root/admin and non-root/admin is a good thing.

So I ended up just making the VM within /home.

This is the Linux way. Don't fight it -- embrace it.

[kubicle]

So I ended up just making the VM within /home.

This is the Linux way. Don't fight it -- embrace it.

Having it in $HOME is indeed the simplest, and in most cases the best choice. There are a few use cases where you could prefer the VMs somewhere else (not having enough spare space on /home...or having /home on regular hard disk and preferring to run VMs from SSD drive, to name a few).

Nevertheless, as stated in the thread (multiple times), even in these cases it's not necessary to run virtualbox as root.

[rybnik]

Thank you!

Oh boy, I am very pleasantly surprised by the helpfulness of everyone who replied here. It seems that y'all spent a non-trivial amount of time on this.

First: this behavior is by design. Second: Linux is not Windows.

Ah, the LINW article got quoted for me! I happen to have read it before, although when I first used Linux (specifically, Ubuntu 10.04), I was surprised by how similar the interface was to windows. Gnome2 was really solid and I liked it, although I like KDE Plasma even more. :-) Gnome3 is disgusting (at least to me).

Your explanation makes a lot of sense.

I worked for Microsoft during this time

Sorry about calling their OS "windoze." Is personal usage of linux common among microsoft coders?

I saw in another thread that your field was TwC. In a post on that thread, you wrote:

Current versions of Windows have fewer vulnerabilities than ever before, largely because of what we did in TwC ... Take a look at the various vulnerabilty and exploit reports you can find. You'll discover that Windows has largely been left behind by attackers, and instead they're going after applications: SQL injection, Java, JavaScript, HTML, Flash.

And now I see that this is (at least partly) because, in Windows, those applications run with superuser privileges by default. Right?

So I ended up just making the VM within /home.

This is the Linux way. Don't fight it -- embrace it.

I think I shall. But if I were to fight it anyway, I note the clever suggestions earlier in this thread of changing the permissions of /vhd (or whatever folder) instead of becoming root. Thanks claydoh, kubicle, and richb (and of course SteveRiley).

But yes, I embrace the Linux.

^No, that photo isn't of me.

[SteveRiley]

Oh boy, I am very pleasantly surprised by the helpfulness of everyone who replied here. It seems that y'all spent a non-trivial amount of time on this.

It's our way

Sorry about calling their OS "windoze." Is personal usage of linux common among microsoft coders?

No need to apologize, I'm not offended -- I've heard worse! I do think all the various spelling permutations are a little silly, though.

I had not touched Linux at any time in my life until the first weekend after 6 May 2009. I figure, if Microsoft no longer needed me, then I no longer needed Microsoft. I can't speak for how other ex-'Softies feel, as I haven't actually spoken with too many about what they're running on their laptops. I will admit that it's been quite refreshing to no longer be saddled with the corporate blinders

I saw in another thread that your field was TwC.

TwC is Trustworthy Computing, the group in Microsoft charged with establishing security and privacy practices across the company. Among other activities, we created the Secure Development Lifecycle, established a common patching strategy for all products, investigate all malware and vulnerability reports, and publish the twice-annual Security Intelligence Report. Contrary to what a lot of detractors wish were true, many intelligent people work across all of Microsoft, even in the security group. As with any large organization, political realities sometimes diminish the value of the smartest contributors. The competitive performance appraisal system is, in my evaluation, the single largest demoralizer at the company. Selfish back-stabbers tend to rise to the top.

And now I see that this is (at least partly) because, in Windows, those applications run with superuser privileges by default. Right?

They run in the same context as the logged-on user. If the user is a local administrator, anything s/he executes has administrative privileges on the system. If the user has a standard account, executed programs run with standard privileges. It's the same with Linux, too.

Attackers are targeting applications because operating systems have become very strong. Microsoft has quite a lot of money to throw at problems; beginning with the "security push" during Longhorn's development, Microsoft invests hundreds of millions in security research and practice. And it's paying off. Does Adobe (Flash) have that kind of resource availability? Probably not. Does Oracle (Java) even care? Not likely. Does J. Random Developer (SQL injection) even know? Usually not.

I think I shall. But if I were to fight it anyway, I note the clever suggestions earlier in this thread of changing the permissions of /vhd (or whatever folder) instead of becoming root.

Contrary to being a fight, creating a dedicated subdirectory and assigning appropriate permissions falls squarely within the Linux way, for the Linux way encompasses many different "ways." You're fitting in quite well

[rybnik]

for the Linux way encompasses many different "ways."

That's one thing I'm liking about it!

I learn a lot from your posts in KFN.

[SteveRiley]

Thank you. It's truly a privilege to hang out here with many smart folks. I've learned quite a lot myself.